plan-issue-claude

SUSPICIOUS: the skill's purpose is plausible, but its footprint is broader than necessary because it downloads and executes an unpinned external CLI via bunx @latest under broad Bash permissions, with no provenance evidence included. The main concern is supply-chain and mutable-runtime execution rather than confirmed malware.